Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

Three major software vendors — Veeam, HashiCorp, and the Django Software Foundation — disclosed a combined 11 vulnerabilities, including a maximum-severity CVSS 10.0 cross-tenant token reuse bug in Terraform MCP Server that could allow attackers to pivot across customer environments. The Veeam flaw enables unauthenticated credential theft, a particularly dangerous vector given Veeam's role in managing backup infrastructure. These vulnerabilities highlight the persistent risk of delayed patching, especially in widely deployed enterprise tools where exploitation can cascade across multiple tenants or customers. When critical infrastructure software like backup solutions and cloud provisioning tools carries unpatched flaws, the blast radius of a successful attack can be organization-wide or even supply-chain-wide.